2011-09-25 08:56:03 +00:00
< ? php
2017-12-04 03:38:03 +00:00
2011-09-25 08:56:03 +00:00
/**
* Name : LDAP Authenticate
* Description : Authenticate a user against an LDAP directory
2015-02-03 23:35:24 +00:00
* Version : 1.1
2011-09-25 08:56:03 +00:00
* Author : Mike Macgirvin < http :// macgirvin . com / profile / mike >
2015-02-03 23:35:24 +00:00
* Author : aymhce
2011-09-25 08:56:03 +00:00
*/
2017-12-04 03:38:03 +00:00
2011-09-25 08:56:03 +00:00
/**
2012-01-31 11:06:20 +00:00
* Friendica addon
2017-12-04 03:38:03 +00:00
*
2011-09-25 08:56:03 +00:00
* Module : LDAP Authenticate
*
* Authenticate a user against an LDAP directory
* Useful for Windows Active Directory and other LDAP - based organisations
* to maintain a single password across the organisation .
*
* Optionally authenticates only if a member of a given group in the directory .
*
2017-12-04 03:38:03 +00:00
* By default , the person must have registered with Friendica using the normal registration
2012-01-31 11:06:20 +00:00
* procedures in order to have a Friendica user record , contact , and profile .
2015-02-03 23:35:24 +00:00
* However , it ' s possible with an option to automate the creation of a Friendica basic account .
2011-09-25 08:56:03 +00:00
*
* Note when using with Windows Active Directory : you may need to set TLS_CACERT in your site
2017-12-04 03:38:03 +00:00
* ldap . conf file to the signing cert for your LDAP server .
*
2018-11-25 07:13:45 +00:00
* The configuration options for this module may be set in the config / addon . config . php file
2011-09-25 08:56:03 +00:00
* e . g .:
*
2018-06-28 03:14:29 +00:00
* [ ldapauth ]
* ; ldap hostname server - required
* ldap_server = host . example . com
* ; dn to search users - required
* ldap_searchdn = ou = users , dc = example , dc = com
* ; attribute to find username - required
* ldap_userattr = uid
2015-02-04 15:55:07 +00:00
*
2018-06-28 03:14:29 +00:00
* ; admin dn - optional - only if ldap server dont have anonymous access
* ldap_binddn = cn = admin , dc = example , dc = com
* ; admin password - optional - only if ldap server dont have anonymous access
* ldap_bindpw = password
2011-09-25 08:56:03 +00:00
*
2018-06-28 03:14:29 +00:00
* ; for create Friendica account if user exist in ldap
* ; required an email and a simple ( beautiful ) nickname on user ldap object
* ; active account creation - optional - default none
* ldap_autocreateaccount = true
* ; attribute to get email - optional - default : 'mail'
* ldap_autocreateaccount_emailattribute = mail
* ; attribute to get nickname - optional - default : 'givenName'
* ldap_autocreateaccount_nameattribute = cn
2015-02-04 15:55:07 +00:00
*
* ... etc .
2011-09-25 08:56:03 +00:00
*/
2019-02-03 21:22:03 +00:00
2022-06-23 05:16:22 +00:00
use Friendica\App ;
2018-12-26 07:28:16 +00:00
use Friendica\Core\Hook ;
2018-10-29 23:40:18 +00:00
use Friendica\Core\Logger ;
2020-11-19 16:18:48 +00:00
use Friendica\Database\DBA ;
2020-01-19 20:26:41 +00:00
use Friendica\DI ;
2017-12-04 03:38:52 +00:00
use Friendica\Model\User ;
2021-10-26 19:44:28 +00:00
use Friendica\Core\Config\Util\ConfigFileLoader ;
2017-11-06 23:55:24 +00:00
2017-12-04 03:38:03 +00:00
function ldapauth_install ()
{
2018-12-26 07:28:16 +00:00
Hook :: register ( 'load_config' , 'addon/ldapauth/ldapauth.php' , 'ldapauth_load_config' );
Hook :: register ( 'authenticate' , 'addon/ldapauth/ldapauth.php' , 'ldapauth_hook_authenticate' );
2011-09-25 08:56:03 +00:00
}
2022-06-23 05:16:22 +00:00
function ldapauth_load_config ( App $a , ConfigFileLoader $loader )
2018-06-28 03:14:29 +00:00
{
2019-02-10 19:10:59 +00:00
$a -> getConfigCache () -> load ( $loader -> loadAddonConfig ( 'ldapauth' ));
2011-09-25 08:56:03 +00:00
}
2022-06-23 05:16:22 +00:00
function ldapauth_hook_authenticate ( App $a , array & $b )
2017-12-04 03:38:03 +00:00
{
2020-11-19 16:18:48 +00:00
$user = ldapauth_authenticate ( $b [ 'username' ], $b [ 'password' ]);
if ( ! empty ( $user [ 'uid' ])) {
$b [ 'user_record' ] = User :: getById ( $user [ 'uid' ]);
$b [ 'authenticated' ] = 1 ;
2017-12-04 03:38:03 +00:00
}
2011-09-25 08:56:03 +00:00
}
2017-12-04 03:38:03 +00:00
function ldapauth_authenticate ( $username , $password )
{
2020-01-19 20:21:12 +00:00
$ldap_server = DI :: config () -> get ( 'ldapauth' , 'ldap_server' );
$ldap_binddn = DI :: config () -> get ( 'ldapauth' , 'ldap_binddn' );
$ldap_bindpw = DI :: config () -> get ( 'ldapauth' , 'ldap_bindpw' );
$ldap_searchdn = DI :: config () -> get ( 'ldapauth' , 'ldap_searchdn' );
$ldap_userattr = DI :: config () -> get ( 'ldapauth' , 'ldap_userattr' );
$ldap_group = DI :: config () -> get ( 'ldapauth' , 'ldap_group' );
$ldap_autocreateaccount = DI :: config () -> get ( 'ldapauth' , 'ldap_autocreateaccount' );
$ldap_autocreateaccount_emailattribute = DI :: config () -> get ( 'ldapauth' , 'ldap_autocreateaccount_emailattribute' );
$ldap_autocreateaccount_nameattribute = DI :: config () -> get ( 'ldapauth' , 'ldap_autocreateaccount_nameattribute' );
2017-12-04 03:38:03 +00:00
2020-11-19 16:18:48 +00:00
if ( ! extension_loaded ( 'ldap' ) || ! strlen ( $ldap_server )) {
Logger :: error ( 'Addon not configured or missing php-ldap extension' , [ 'extension_loaded' => extension_loaded ( 'ldap' ), 'server' => $ldap_server ]);
2017-12-04 03:38:03 +00:00
return false ;
}
2020-11-19 16:18:48 +00:00
if ( ! strlen ( $password )) {
Logger :: error ( 'Empty password disallowed' , [ 'provided_password_length' => strlen ( $password )]);
return false ;
}
2017-12-04 03:38:03 +00:00
2020-11-19 16:18:48 +00:00
$connect = @ ldap_connect ( $ldap_server );
2017-12-04 03:38:03 +00:00
if ( $connect === false ) {
2020-11-19 16:18:48 +00:00
Logger :: warning ( 'Could not connect to LDAP server' , [ 'server' => $ldap_server ]);
2017-12-04 03:38:03 +00:00
return false ;
}
@ ldap_set_option ( $connect , LDAP_OPT_PROTOCOL_VERSION , 3 );
@ ldap_set_option ( $connect , LDAP_OPT_REFERRALS , 0 );
if (( @ ldap_bind ( $connect , $ldap_binddn , $ldap_bindpw )) === false ) {
2020-11-19 16:18:48 +00:00
Logger :: warning ( 'Could not bind to LDAP server' , [ 'server' => $ldap_server , 'binddn' => $ldap_binddn , 'errno' => ldap_errno ( $connect ), 'error' => ldap_error ( $connect )]);
2017-12-04 03:38:03 +00:00
return false ;
}
$res = @ ldap_search ( $connect , $ldap_searchdn , $ldap_userattr . '=' . $username );
if ( ! $res ) {
2020-11-19 16:18:48 +00:00
Logger :: notice ( 'LDAP user not found.' , [ 'searchdn' => $ldap_searchdn , 'userattr' => $ldap_userattr , 'username' => $username , 'errno' => ldap_errno ( $connect ), 'error' => ldap_error ( $connect )]);
2017-12-04 03:38:03 +00:00
return false ;
}
$id = @ ldap_first_entry ( $connect , $res );
if ( ! $id ) {
2020-11-19 16:18:48 +00:00
Logger :: notice ( 'Could not retrieve first LDAP entry.' , [ 'searchdn' => $ldap_searchdn , 'userattr' => $ldap_userattr , 'username' => $username , 'errno' => ldap_errno ( $connect ), 'error' => ldap_error ( $connect )]);
2017-12-04 03:38:03 +00:00
return false ;
}
$dn = @ ldap_get_dn ( $connect , $id );
if ( !@ ldap_bind ( $connect , $dn , $password )) {
2020-11-19 16:18:48 +00:00
Logger :: notice ( 'Could not authenticate LDAP user with provided password' , [ 'errno' => ldap_errno ( $connect ), 'error' => ldap_error ( $connect )]);
2017-12-04 03:38:03 +00:00
return false ;
}
2021-06-08 03:55:24 +00:00
if ( strlen ( $ldap_group ) && @ ldap_compare ( $connect , $ldap_group , 'member' , $dn ) !== true ) {
2020-11-19 16:18:48 +00:00
$errno = @ ldap_errno ( $connect );
if ( $errno === 32 ) {
Logger :: notice ( 'LDAP Access Control Group does not exist' , [ 'errno' => $errno , 'error' => ldap_error ( $connect )]);
} elseif ( $errno === 16 ) {
Logger :: notice ( 'LDAP membership attribute does not exist in access control group' , [ 'errno' => $errno , 'error' => ldap_error ( $connect )]);
2017-12-04 03:38:03 +00:00
} else {
2021-06-08 03:55:24 +00:00
Logger :: notice ( 'LDAP user isn\'t part of the authorized group' , [ 'dn' => $dn ]);
2017-12-04 03:38:03 +00:00
}
2020-11-19 16:18:48 +00:00
2017-12-04 03:38:03 +00:00
@ ldap_close ( $connect );
return false ;
}
2021-06-08 03:55:24 +00:00
if ( $ldap_autocreateaccount == 'true' && ! DBA :: exists ( 'user' , [ 'nickname' => $username ])) {
if ( ! strlen ( $ldap_autocreateaccount_emailattribute )) {
$ldap_autocreateaccount_emailattribute = 'mail' ;
}
if ( ! strlen ( $ldap_autocreateaccount_nameattribute )) {
$ldap_autocreateaccount_nameattribute = 'givenName' ;
}
$email_values = @ ldap_get_values ( $connect , $id , $ldap_autocreateaccount_emailattribute );
$name_values = @ ldap_get_values ( $connect , $id , $ldap_autocreateaccount_nameattribute );
return ldap_createaccount ( $username , $password , $email_values [ 0 ] ? ? '' , $name_values [ 0 ] ? ? '' );
2020-11-19 16:18:48 +00:00
}
2015-02-03 23:35:24 +00:00
2020-11-19 16:18:48 +00:00
try {
$authentication = User :: getAuthenticationInfo ( $username );
return User :: getById ( $authentication [ 'uid' ]);
} catch ( Exception $e ) {
Logger :: notice ( 'LDAP authentication error: ' . $e -> getMessage ());
return false ;
2017-12-04 03:38:03 +00:00
}
2015-02-03 23:35:24 +00:00
}
2020-11-19 16:18:48 +00:00
function ldap_createaccount ( $username , $password , $email , $name )
2017-12-04 03:38:03 +00:00
{
2020-11-19 16:18:48 +00:00
if ( ! strlen ( $email ) || ! strlen ( $name )) {
Logger :: notice ( 'Could not create local user from LDAP data, no email or nickname provided' );
return false ;
}
try {
$user = User :: create ([
'username' => $name ,
'nickname' => $username ,
2021-06-08 03:55:24 +00:00
'email' => $email ,
2020-11-19 16:18:48 +00:00
'password' => $password ,
'verified' => 1
]);
Logger :: info ( 'Local user created from LDAP data' , [ 'username' => $username , 'name' => $name ]);
return $user ;
} catch ( Exception $ex ) {
Logger :: error ( 'Could not create local user from LDAP data' , [ 'username' => $username , 'exception' => $ex -> getMessage ()]);
}
return false ;
2015-02-03 23:35:24 +00:00
}